Privacy Policy

---

Diskova is a music-discovery app with a simple premise: nobody posts. Your Last.fm listening history is the content. This policy explains exactly what we collect, why, where it goes, and how to make it stop. It describes what the app actually does — nothing aspirational.

Who we are

Diskova (“we”, “the app”). For any privacy question or request, contact Diskova.app@protonmail.com.

The short version

• We read your Last.fm scrobbles and friends, with your permission, to build your feed and match you to people with similar taste.
• We do not collect your name, email, or location. We show no ads and run no third-party analytics or tracking. Your data is never sold.
• You can permanently delete your account and everything tied to it, from inside the app, at any time.

What we collect, and why

Everything below is collected only to make the app work — never for advertising or tracking.

Data	What it is	Why
Last.fm connection	Your Last.fm username and a session key, obtained when you approve the connection on Last.fm’s own page.	To read your listening on your behalf. The session key is stored so only our server can use it; the app on your phone can never read it.
Listening history	Your scrobbles: track, artist, album, and the time played.	It is the feed. It also drives taste-matching and your weekly recap.
Last.fm friends	The usernames on your Last.fm friends list.	Only to find which of them are already on Diskova, when you ask us to. You control this (see Your controls).
Profile	A chosen handle (not your real name) and a random member code we generate for you.	To identify you to friends and matches inside the app.
Things you make in the app	Notes you write on a track, tracks you keep, rooms you join, people you add or block.	These are the app’s features.
Settings	Your device time zone; quiet hours; and your findability and recap preferences.	Time zone sets when quiet hours and the Sunday recap apply. The rest are your privacy controls.
Notifications token	A push token for your device, and the notifications we send it.	To deliver the handful of alerts you can receive (a room waking, a credit, a friend request, the weekly envelope).

We do not collect: your real name, email address (the account we create for you internally uses a placeholder that reaches no inbox), phone number, location, contacts, photos, payment details, or any advertising identifier. The app contains no analytics, no advertising, and no third-party tracking software of any kind.

Where your data goes

We use a small number of service providers to run the app. They process your data on our behalf; none of them are given it for their own purposes.

• Supabase — our database. This is where your account and everything above is stored.
• Railway — our server, which reads your Last.fm data on a schedule, prepares matches and recaps, and sends notifications.
• Last.fm — we send requests to Last.fm’s API, using your session key, to read your scrobbles and friends. This is the source of your listening data.
• Deezer and Apple iTunes — to find a 30-second preview for a track, we send the track and artist name (nothing about you) to their public catalogues.
• Apple Push Notification service, via Expo — to deliver notifications, we send your device’s push token and the notification text.

Quiet-hour plays are a special case: listening during hours you mark quiet is visible only to you. It still counts toward your own recap and matching, but it is never shown to anyone else.

What we never do

• We do not sell your data, or share it for anyone else’s advertising.
• We do not track you across other apps or websites.
• We do not show member counts, populations, or anything that turns your listening into a public metric.

Keeping and deleting your data

We keep your data for as long as your account exists. Two things you should know:

• Leaving is permanent and complete. In Settings, Leave the catalogue starts a 48-hour clock. After it, your account and every piece of data tied to it — your listening history, notes, keeps, matches, settings, and Last.fm connection — is permanently deleted. There is no archive and nothing can be restored. If you sign in again afterwards, you start fresh.
• Signing out is not leaving. Signing out ends the session on your device but keeps your account. Only Leave the catalogue deletes it.

You can also export the tracks you have kept, as a file, from the Keeps screen — the record of what you discovered here, to take anywhere.

Your controls

• Quiet hours — mark hours during which your listening is private to you.
• Findable by name — turn this off to be reachable only by your member code.
• Last.fm friends — opt out of appearing when other people search their Last.fm friends for Diskova members.
• The weekly envelope — turn the Sunday recap notification off.
• Block — a blocked member and you become completely invisible to each other.
• Notifications — you can decline them at the system level; nothing else depends on them.

Children

Diskova is not directed to children. You must meet Last.fm’s own minimum age to connect an account, and you must be at least 13 (or the minimum age of digital consent in your country, where higher) to use Diskova.

International users

Your data is stored and processed on the infrastructure of the providers named above, which may be located outside your country. Depending on where you live, you may have rights to access, correct, or delete your data, and to object to or restrict its processing. The in-app Leave the catalogue control performs a full deletion; for any other request, contact us at the address below and we will act on it.

Changes to this policy

If we change what we collect or how we use it, we will update this page and its effective date. Material changes will be surfaced in the app.

Contact

Questions, requests, or concerns: Diskova.app@protonmail.com.